zeronetworks / rpcfirewall
☆482Updated 2 months ago
Related projects ⓘ
Alternatives and complementary repositories for rpcfirewall
- A centralized resource for previously documented WDAC bypass techniques☆483Updated 6 months ago
- Event Tracing For Windows (ETW) Resources☆349Updated last month
- A repository that maps commonly used attacks using MSRPC protocols to ATT&CK☆311Updated last year
- ☆222Updated 6 months ago
- A C# utility for interacting with SCCM☆571Updated 2 months ago
- Detect and respond to Cobalt Strike beacons using ETW.☆481Updated 2 years ago
- ☆377Updated last year
- Aims to identify sleeping beacons☆489Updated 5 months ago
- Moneta is a live usermode memory analysis tool for Windows with the capability to detect malware IOCs☆686Updated 8 months ago
- ☆187Updated 3 weeks ago
- Azure Outlook Command & Control (C2) - Remotely control a compromised Windows Device from your Outlook mailbox. Threat Emulation Tool for…☆462Updated last year
- MAL-CL (Malicious Command-Line)☆308Updated last year
- Active Directory delegation management tool☆284Updated last year
- Sysmon EDR POC Build within Powershell to prove ability.☆218Updated 3 years ago
- Sysmon-Like research tool for ETW☆336Updated 2 years ago
- Sysmon configuration file template with default high-quality event tracing☆454Updated 9 months ago
- Cobalt Strike UDRL for memory scanner evasion.☆879Updated 5 months ago
- ☆462Updated last year
- Find vulnerabilities in AD Group Policy, but do it better than Grouper2 did.☆700Updated 3 months ago
- A PowerShell armoury for security guys and girls☆461Updated 9 months ago
- "Golden" certificates☆650Updated 3 months ago
- Checks running processes, process metadata, Dlls loaded into your current process and the each DLLs metadata, common install directories,…☆685Updated last year
- RPC Monitor tool based on Event Tracing for Windows☆330Updated 3 months ago
- Collect-MemoryDump - Automated Creation of Windows Memory Snapshots for DFIR☆220Updated 8 months ago
- ☆658Updated 2 weeks ago
- Test the accuracy of Endpoint Detection and Response (EDR) software with simple script which executes various ATT&CK/LOLBAS/Invoke-Cradle…☆289Updated 3 years ago
- An effort to track security vendors' use of Microsoft's Antimalware Scan Interface☆229Updated 2 years ago
- ☆732Updated last year
- A POC for the new injection technique, abusing windows fork API to evade EDRs. https://www.blackhat.com/eu-22/briefings/schedule/index.ht…☆621Updated last year
- A collection of tools to interact with Microsoft Security Response Center API☆95Updated 10 months ago